Loading...
Loading...
Found 33 Skills
Analyzes PHP code for SQL injection vulnerabilities. Detects query concatenation, ORM misuse, raw queries, dynamic identifiers, prepared statement bypasses.
Prevent SQL injection attacks using prepared statements, parameterized queries, and input validation. Use when building database-driven applications securely.
Detect and fix SQL injection vulnerabilities in any framework. Covers Laravel (DB::raw, whereRaw), Node.js (template literals in queries), Python (f-strings in SQL), and Cloudflare D1. Enforces parameterized bindings everywhere. Use when writing database queries, reviewing code for injection, or fixing SQL injection findings.
Identifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests using manual techniques and automated tools like sqlmap. The tester detects injection points through error-based, union-based, blind boolean, and time-based blind techniques across all major database engines (MySQL, PostgreSQL, MSSQL, Oracle) to demonstrate data extraction, authentication bypass, and potential remote code execution. Activates for requests involving SQL injection testing, SQLi exploitation, database security assessment, or injection vulnerability verification.
Professional Skills and Methodologies for SQL Injection Testing
SQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution paths.
NoSQL injection playbook. Use when MongoDB-style operators, JSON query objects, flexible search filters, or backend query DSLs may allow data or logic abuse.
Эксперт по защите от SQL injection. Используй для parameterized queries, input validation и database security.
Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.
Use when the user needs to write, review, or migrate SQL queries in ADVPL/TLPP using BeginSQL/EndSQL blocks and macro expressions (%table%, %xfilial%, %notDel%, %exp%, %Order%) instead of raw TCQuery string concatenation -- covering INNER/LEFT JOIN patterns, aggregations (SUM/COUNT/GROUP BY/HAVING), subqueries, column type declarations, DML via TCSqlExec, and SQL-injection prevention. Also triggers on Portuguese phrasing like "consulta SQL", "query embutida", "migrar TCQuery para BeginSQL", "escrever SELECT com filial e notDel", or "montar JOIN em ADVPL".
Database security, access control, and data protection
Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist a...